Post

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

I think the Brussels folks will tell you that CRA's standards rise as state of the art rises, and if it had been in place 10 or 20 years ago, "secure by design" would have been a very different target. Open question whether that happens in practice or just gets ossified into 2027-era audit docs.

1/6/26, 10:06 pm0 reposts2 likes

I keep admitting I'm naive for thinking it will change how enterprises engage with open source but honestly, I still think it might

It still could. Lots of devil in the details.

that 'top level SBOM' thing is what makes me most twitchy but having thumbed through a couple of CE mark product booklets over the weekend making vendors do the same for digital products really feels like a shift in how orgs *have* to think about software and OSS even if they don't know it yet

when talking to normies, I explain that the law requires software vendors to have a list of ingredients, and the universal response is "you mean... they don't already have that?"

I feel like the CRA’s Annex I has really good, timeless principles in it, but yeah, they would’ve chosen different timeless principles 10-20 years ago. Luckily there is a calendar for future revision based on experience.

The idea is to revisit this law, like all EU laws, 5-10 years afterwards and see if revision is needed. The plan is that standards development will be almost continuous: once one version of a standard is harmonized, work on the next iteration can begin.

what's the EU equivalent of test262 for legislation revision/standards development? (test262 is such an amazing accomplishment, that model ought to get used more places)